Free NSE4_FGT_AD-7.6 sample questions

Correct answer: The `fabric-object-unification` setting is set to `local` on the root FortiGate.

When the Security Fabric is enabled, global objects such as addresses, services and schedules are synchronized from the upstream FortiGate to downstream devices by default. This is controlled on the root by `config system csf` > `set fabric-object-unification {default | local}`: with default, global CMDB objects are synchronized, and with local they are not. Individual objects must also have Fabric synchronization (`fabric-object`) enabled. Because the branches are already authorized and online, the Fabric link on TCP 8013 (the default upstream-port) is working and authorization is not the problem.

Correct answer: The packet matched the implicit deny policy.

The debug message 'Denied by forward policy check (policy 0)' specifically indicates that the packet failed to match any user-defined firewall policy and hit the default implicit deny policy, which has an ID of 0. This means there is no valid firewall policy allowing traffic from 192.168.1.10 to 10.0.2.50 on port 80.

Correct answers: It displays the current active sessions in the kernel session table.; Its output can be limited to specific sessions by first defining criteria with `diagnose sys session filter`.

The `diagnose sys session list` command shows the sessions in the kernel session table. Each entry includes addresses, ports, protocol, state, policy ID and offload state.

The `diagnose sys session filter` command sets criteria such as source, destination, destination port or policy. The list command then shows only the sessions that match.

Correct answer: Create a VIP with 'External IP' 203.0.113.10 and 'Mapped IP' 192.168.1.50. Enable 'Port Forwarding', set 'External Service Port' to 8443, and 'Map to Port' to 443.

Port forwarding is configured in the VIP object itself: the External IP address (203.0.113.10) and the mapped internal address (192.168.1.50), with Port Forwarding enabled, the External service port set to 8443 (the port that clients connect to on the WAN) and the mapped port (GUI 'Map to IPv4 port', CLI mappedport) set to 443 on the server. With central NAT disabled (the default), the VIP is then selected as the Destination of the firewall policy from the WAN interface to the internal interface. With central NAT enabled, the VIP is created under Policy & Objects > DNAT & Virtual IPs instead and the policy uses the internal mapped address (FortiOS 7.6.0 Administration Guide, Virtual IPs and Central DNAT). A service object for port 8443 only matches traffic and does not translate the port, Central SNAT translates source addresses rather than destinations, and port forwarding is a VIP setting, not an option of the firewall policy.

Correct answer: The Collector Agent gathers logon events (from DC agents or by polling the Domain Controllers) and sends the user logon information to the FortiGate.

With a Collector Agent (CA), logon events are gathered either from DC agents installed on the domain controllers (DC-agent mode, DC agents send to the CA on UDP 8002) or by the CA polling the DCs. The CA then sends the user IP-to-group logon information to the FortiGate over TCP 8000. The FortiGate does not poll the DCs itself in this mode, and RADIUS/multicast are not used.

Correct answer: In an SSL Inspection & Authentication policy, which pre-matches traffic before it is sent to the IPS engine for security policy matching.

In policy-based NGFW mode (available only when the VDOM inspection mode is flow-based), SSL inspection - formerly configured in the VDOM settings - is configured in SSL Inspection & Authentication policies. These policies pre-match traffic (they have no schedule or action) and redirect it to the IPS engine, where security policies match applications, URL categories, users and groups and apply UTM inspection. Central NAT is always enabled in this mode, but the Central SNAT table only defines source NAT, not SSL inspection.